CVE-2025-61726 affecting package golang for versions less than 1.24.12-1

CVE-2025-61726 affecting package golang for versions less than 1.24.12-1. A patched version of the package is available...

GCVE-1-2026-0009

creationtimestamp| type| source ---|---|--- 2026-01-29 14:42:24+00:00| seen| https://vulnerability.circl.lu/bundle/822f8677-7cc7-44e9-8414-329e2be8aaf1...

GCVE-1-2026-0011

creationtimestamp| type| source ---|---|--- 2026-01-29 14:42:24+00:00| seen| https://vulnerability.circl.lu/bundle/822f8677-7cc7-44e9-8414-329e2be8aaf1...

GCVE-1-2026-0010

creationtimestamp| type| source ---|---|--- 2026-01-29 14:42:24+00:00| seen| https://vulnerability.circl.lu/bundle/822f8677-7cc7-44e9-8414-329e2be8aaf1...

TencentOS Server 4: python-pyasn1 (TSSA-2026:0038)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0038 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

📄 OpenSSL 3.x ASN.1 AES‑GCM Nonce Stack Corruption

This Metasploit auxiliary module generates a specially crafted CMS file encoded in DER format to test a stack-based buffer overflow vulnerability in OpenSSL's ASN.1 parser related to improper handling of oversized AES-GCM nonce IV values within AES-GCM-Parameters as defined in RFC 5084. The...

AZL-75648 CVE-2025-61730 affecting package msft-golang for versions less than 1.24.12-1

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries for instance the Client Hello and Encrypted Extensions messages, the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosu...

AZL-78929 CVE-2025-61728 affecting package golang 1.25.7-1

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive...

AZL-75707 CVE-2025-61728 affecting package golang for versions less than 1.24.12-1

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive...

AZL-78933 CVE-2025-61730 affecting package golang 1.25.7-1

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries for instance the Client Hello and Encrypted Extensions messages, the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosu...

AZL-75731 CVE-2025-61730 affecting package golang for versions less than 1.25.6-1

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries for instance the Client Hello and Encrypted Extensions messages, the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosu...

AZL-75701 CVE-2025-61730 affecting package golang for versions less than 1.24.12-1

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries for instance the Client Hello and Encrypted Extensions messages, the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosu...

CVE-2020-36968: Insufficiently Protected Credentials

M/Monit 3.7.4 contains an authentication vulnerability that allows authenticated attackers to retrieve user password hashes through an administrative API endpoint. Attackers can send requests to the /api/1/admin/users/list and /api/1/admin/users/get endpoints to extract MD5 password hashes for al...

DLA-4458-1 python-django - security update

Bulletin has no description...

CVE-2020-36969: Incorrect Authorization

M/Monit 3.7.4 contains a privilege escalation vulnerability that allows authenticated users to modify user permissions by manipulating the admin parameter. Attackers can send a POST request to the /api/1/admin/users/update endpoint with a crafted payload to grant administrative access to a standa...

Drupal Commerce Paybox security vulnerabilities

Drupal Commerce Paybox is a payment plugin for the Drupal community. There are security vulnerabilities in the Drupal Commerce Paybox versions 7-x-1.0 to 7.X-1.5. These vulnerabilities stem from improper encryption signature verification, which may lead to authentication bypasses...

openSUSE Security Advisory (SUSE-SU-2026:0290-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2026:0299-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2026:0290-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the context variable evaluation process. An attacker with policy creation privileges can exhaust system memory and disrupt service availability with policies that exponentially...